Privacy Policy

Effective Date: 13 July 2026

1. Introduction

Boundary Review ("we", "us", or "our") is committed to protecting the privacy and security of the personal information entrusted to us.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us or use the Boundary Review platform.

Boundary Review is a UK sole trader business providing examination review and assessment management software for schools, academies and multi-academy trusts.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

Boundary Review is the Data Controller for personal information collected through our website and for customer account administration.

When schools use the Boundary Review platform to upload pupil or assessment data, the school remains the Data Controller, and Boundary Review acts as the Data Processor, processing information only on the school's documented instructions.

Business Name: Boundary Review

Email: info@boundaryreview.co.uk

Correspondence Address: All correspondence digitally through email

3. Information We Collect

Information you provide directly

We may collect:

Name
Email address
Job title
School or organisation name
Telephone number (where provided)
Information submitted through enquiry forms
Information provided during demonstrations
Customer support enquiries
Marketing preferences

Customer Account Information

Where your organisation subscribes to Boundary Review, we may collect:

User account information
Login details
Account permissions
User activity logs
Service usage information
Support history

Educational Data

Schools using Boundary Review may upload educational information, including:

Candidate identifiers
Examination entries
Subject information
Raw examination marks
Grade boundaries
Assessment outcomes
Review recommendations
Review outcomes

Boundary Review processes this information solely for the purpose of providing the contracted service to the school.

We do not use pupil data for advertising, profiling or marketing.

4. Website Analytics and Cookies

Our website is hosted using Wix.

We may use Google Analytics (via Wix) to understand how visitors use our website and to improve the user experience.

Analytics information may include:

Pages visited
Time spent on pages
Browser type
Device type
Approximate location
Referral source

Where required by law, analytics cookies will only be placed after you have provided consent through our cookie banner.

Further information is available in our Cookie Policy.

5. How We Use Personal Information

We use personal information to:

Respond to enquiries
Arrange demonstrations
Create customer accounts
Provide the Boundary Review service
Deliver customer support
Improve our website and software
Send important service updates
Send marketing communications where you have consented or where permitted by law
Comply with legal obligations
Maintain the security of our systems

We do not sell personal information to third parties.

6. Lawful Basis for Processing

We process personal information under one or more of the following lawful bases:

Consent
Performance of a contract
Legitimate interests
Compliance with legal obligations

Where schools upload pupil information, processing is carried out on behalf of the school under a separate Data Processing Agreement.

7. Cloud Storage and Google Workspace

Boundary Review is currently delivered using secure Google Workspace services.

Customer information may be processed or stored using Google Workspace applications, including:

Google Drive
Google Sheets
Gmail

These services are used solely to provide and support the Boundary Review service.

Google Workspace provides enterprise-grade security, including encryption in transit and at rest, security monitoring and access management.

Access to customer information is restricted to Boundary Review where necessary to deliver the service.

Google acts as a sub-processor for certain services and processes information in accordance with its applicable data processing and security commitments.

8. Sharing Information

We do not sell or rent personal information.

Information may be shared with carefully selected service providers where necessary to operate our business, including:

Wix (website hosting)
Google Workspace
Google Analytics
Professional advisers where legally required

Information will only be shared where necessary and appropriate safeguards are in place.

We may also disclose information where required by law.

9. International Transfers

Some of the service providers we use may process information outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR.

10. Data Security

Boundary Review takes appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure.

Our security measures include:

Secure Google Workspace infrastructure.
Encryption of data in transit and at rest through Google Workspace.
Multi-factor authentication (MFA) for administrator accounts.
Strong password requirements.
HTTPS encrypted connections.
Access controls restricting customer information to authorised personnel only.
Regular review of access permissions.
Google Drive version history to assist with the recovery of previous file versions where appropriate.
Automated monthly backups of customer spreadsheets using Google Apps Script. Backup copies are securely stored within Boundary Review's Google Workspace environment to support business continuity and data recovery in the event of accidental deletion or file corruption.
Ongoing application of Google Workspace security updates and security features.

Although no electronic system can ever be completely secure, Boundary Review continually reviews and improves its security practices to reduce risk and protect customer information.

11. Data Retention

We only retain personal information for as long as necessary to fulfil the purposes described within this Privacy Policy or to comply with legal obligations.

Customer account information is normally retained while an account remains active and for a reasonable period afterwards where necessary for legal, contractual or operational purposes.

Educational data is retained in accordance with the agreement with each school.

Where accounts are closed, data will be securely deleted in accordance with our retention procedures unless we are legally required to retain it.

12. Your Rights

Under UK GDPR you may have the right to:

Request access to your personal information.
Request correction of inaccurate information.
Request deletion of personal information.
Request restriction of processing.
Object to processing.
Request portability of your information.
Withdraw consent where processing relies upon consent.
Lodge a complaint with the Information Commissioner's Office (ICO).

Requests can be made by contacting:

info@boundaryreview.co.uk

13. Children's Information

Boundary Review does not provide services directly to children.

Any pupil information processed through our platform is processed solely on behalf of schools acting as Data Controllers.

Boundary Review does not knowingly collect personal information directly from children through its website.

14. Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices or content of external websites.

Users should review the privacy policies of any third-party websites they visit.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, technology or our services.

The latest version will always be published on our website together with the effective date.

16. Contact Us

If you have any questions regarding this Privacy Policy or how Boundary Review processes personal information, please contact:

Boundary Review